Closed alex-dot closed 8 years ago
Firstly, if you've made changes to your Shibboleth configuration files, make sure all your services have been restarted -- and ensure that whenever you restart shibd and the shibauthorizer and shibresponder (in that order). I've been left confused a few times by only restarting part of the stack.
Assuming all the parts have the correct config present, then it looks like all of the Shibboleth headers are making it through to your PHP application (eg HTTPSHIB* headers and HTTP_MAIL). I'd firstly suggest checking your attribute-map.xml
file for Shibboleth to ensure that the mail
attribute is listed and/or uncommented and its ID is correct. I would assume it is, given the presence of HTTP_MAIL, but it's worth checking.
Next, you can check whether your Shibauthorizer is yielding the correct REMOTE_USER header (seen as Variable-REMOTE_USER
from a FastCGI authorizer) like so:
location /secure {
...
shib_request_set $shib_remote_user $upstream_http_variable_remote_user;
proxy_set_header X-TEST $shib_remote_user;
proxy_pass http://[ip]:8081;
}
This loads the upstream variable from the shibauthorizer response into an Nginx variable in this scope, and then sets that variable to be the header X-TEST
before being sent to your backend Apache instance. If you see X-TEST
with your expected REMOTE_USER
attribute, then this proves that Apache is the issue. If you don't, then check your Shibboleth configuration as there might be something else (perhaps in shibboleth2.xml
) that's overriding your REMOTE_USER config. At a hunch though, I suspect Apache or its modules are getting in the way here and either overriding or dropping the REMOTE_USER header.
In either case, you'd be best to consider running PHP under FastCGI so Nginx can talk to it directly (see http://php-fpm.org/ and various tutorials at https://www.nginx.com/resources/wiki/start/). That avoids the extra translation step to Apache, simplifies your stack, reduces memory usage and will speed up your application considerably. You can also gain the benefit of being able to avoid the use of headers (see https://github.com/nginx-shib/nginx-http-shibboleth/tree/development) -- as you can pass environment variables to the PHP FastCGI process through Nginx's configuration.
Debugging this kind of stack is very hard as Shibboleth's FastCGI apps don't log anything irrespective of logging settings, so if you get stuck, try and switch to running PHP under FastCGI and simplify things. If you're still stuck at this point, create a super-simple HTTP proxy (I'd suggest Bottle for Python) and use that as your backend proxy_pass application -- and print out the request headers.
First of all: Thank you for your detailed answer. I have seldomly seen so much effort put into answering how to debug such a problem. Kudos!
After installing php-fpm (you are right, I should have done that earlier) everything worked.
I tried to get apache working anyways and for a time I thought that adding include fastcgi.conf
would help. Don't know, probably some setting one would have to set in apache.
Oh and extra-kudos for mentioning bottle. ;)
No problem, glad you could get things working! Documentation improvements are welcome, if there's anything that could be better.
Since you're using FastCGI, you can try out the development branch (with header use disabled by default) and use environment variables only. Feedback welcome too. On Wed, 9 Mar 2016 at 21:58, alex. notifications@github.com wrote:
First of all: Thank you for your detailed answer. I have seldomly seen so much effort put into answering how to debug such a problem. Kudos!
After installing php-fpm (you are right, I should have done that earlier) everything worked.
I tried to get apache working anyways and for a time I thought that adding include fastcgi.conf would help. Don't know, probably some setting one would have to set in apache.
Oh and extra-kudos for mentioning bottle. ;)
— Reply to this email directly or view it on GitHub https://github.com/nginx-shib/nginx-http-shibboleth/issues/12#issuecomment-194262583 .
I am trying to configure shibboleth through nginx but am currently stuck at not getting the Remote-User variable displayed. I am currently releasing two attributes one of which is mail which I have defined to be assigned as REMOTE_USER:
But when checking on the shibboleth-secured site, I do not see the variable. This is all I get:
Note that I proxy_pass to Apache so it can compile the PHP. Could that be the problem? On plain Apache (with mod_shib) the variable is set correctly. Here is my vhost conf: